types.db

package: collectd

title: types.db(5)

summary: Data\-set specifications for the system statistics collection daemon

text:
# types.db(5)

## NAME
types.db - Data-set specifications for the system statistics collection daemon collectd

## SYNOPSIS

```
  bitrate    value:GAUGE:0:4294967295
  counter    value:COUNTER:U:U
  if_octets  rx:COUNTER:0:4294967295, tx:COUNTER:0:4294967295
```

## DESCRIPTION
The "types.db" file contains collectd's metric type specifications. Each line describes one metric type, which is called "data set" in collectd. Each line consists of two or more fields delimited by spaces and/or horizontal tabs.

For example, the following defines two data sets, "bytes" and "total_bytes".

```
  bytes        value:GAUGE:0:U
  total_bytes  value:DERIVE:0:U
```

The first field defines the name of the data set. By convention, data set names use lower-case alphanumeric characters and underscores ("_") only. Also by convention, if a metric makes sense both as a cumulative metric (e.g. "DERIVE") and a non-cumulative metric (i.e. "GAUGE"), the cumulative metric gets a "total_" prefix. For example, "bytes" is a "GAUGE" and "total_bytes" is a "DERIVE".

The second and each following field defines a named metric value, called "data source". New data sets with multiple data sources are strongly discouraged. Each field is a colon-separated tuple of the data source name, value type, minimum and maximum values: ds-name:ds-type:min:max.

- ds-name is, by convention, a lower-case alphanumeric string. If the data set contains a single data source, it is called "value" by convention. Data source names must be unique within a data set.

- ds-type may be DERIVE, GAUGE, or COUNTER. For historic reasons a type called ABSOLUTE is also supported, but its use is strongly discouraged, and it should not be used for new metric type definitions.

- min and max define the range of valid values this data source. Either or both may be unbounded, which is specified by providing "U" instead of a number. For cumulative metric values, min and max apply to the value's rate, not the raw cumulative metric value.

## FILES
The location of the types.db file is defined by the TypesDB configuration option (see collectd.conf(5)). It defaults to collectd's shared data directory, i. e. prefix/share/collectd/.

## CUSTOM TYPES
If you want to specify custom types, you should do so by specifying a custom file in addition to the default one (see FILES) above. You can do that by having multiple TypesDB statements in your configuration file or by specifying more than one file in one line.

For example:

```
 TypesDB "/opt/collectd/share/collectd/types.db"
 TypesDB "/opt/collectd/etc/types.db.custom"
```

Note: Make sure to make this file available on all systems if you're sending values over the network.

## SEE ALSO
collectd(1), collectd.conf(5), rrdcreate(1)

## AUTHOR
collectd has been written by Florian Forster <octo at collectd.org>.

This manpage has been written by Sebastian Harl <sh at tokkee.org>.


connman-service.config

package: connman

title: connman-service.config(5)

summary: ConnMan service provisioning file

text:
# connman-service.config(5)

## NAME
service-name.config - ConnMan service provisioning file

## SYNOPSIS
/var/lib/connman/service-name.config

## DESCRIPTION
ConnMan's services are configured with so called "provisioning files" which reside under /var/lib/connman/. The files can be named anything, as long as they end in .config. The provisioning files can be used to configure for example secured wireless access points which need complex authentication, for example eduroam, or for static IPs and so on. Each provisioning file can be used for multiple services at once.

## FILE FORMAT
The configuration file consists of sections (groups) of key-value pairs. Lines beginning with a '#' and blank lines are considered comments. Sections are started by a header line containing the section enclosed in '[' and ']', and ended implicitly by the start of the next section or the end of the file. Each key-value pair must be contained in a section.

Description of sections and available keys follows:

### [global]
This section is optional, and can be used to describe the actual file. The two allowed fields for this section are:

Name=name

Name of the network.

Description=description

Description of the network.

### [service_*]
Each provisioned service must start with a [service_*] tag, with * replaced by an unique name within the file. The allowed fields are:

Type=ethernet | wifi

Mandatory. Other types than ethernet or wifi are not supported.

IPv4=off | dhcp | network/netmask/gateway

IPv4 settings for the service. If set to off, IPv4 won't be used. If set to dhcp, dhcp will be used to obtain the network settings. netmask can be specified as length of the mask rather than the mask itself. The gateway can be omitted when using a static IP.

IPv6=off | auto | network/prefixlength/gateway

IPv6 settings for the service. If set to off, IPv6 won't be used. If set to auto, settings will be obtained from the network.

IPv6.Privacy=disabled | enabled | preferred

IPv6 privacy settings as per RFC3041.

MAC=address

MAC address of the interface to be used. If not specified, the first found interface is used. Must be in format ab:cd:ef:01:23:45.

DeviceName=ifname

Device name the interface to be used, e.g. eth0. MAC takes preference over DeviceName.

Nameservers=servers

Comma separated list of nameservers.

SearchDomains=domains

Comma separated list of DNS search domains.

Timeservers=servers

Comma separated list of timeservers.

Domain=domain

Domain name to be used.

The following keys can only be used for wireless networks:

Name=name

A string representation of an network SSID. If the SSID field is present, the Name field is ignored. If the SSID field is not present, this field is mandatory.

SSID=ssid

SSID: A hexadecimal representation of an 802.11 SSID. Use this format to encode special characters including starting or ending spaces.

Passphrase=passphrase

RSN/WPA/WPA2 Passphrase.

Security=type

The security type of the network. Possible values are psk (WPA/WPA2 PSK), ieee8021x (WPA EAP), none and wep. When not set, the default value is ieee8021x if an EAP type is configured, psk if a passphrase is present and none otherwise.

Hidden=true | false

If set to true, then this AP is hidden. If missing or set to false, then AP is not hidden.

The following keys are used for WPA EAP (when Security=ieee8021x):

EAP=tls | ttls | peap

EAP type to use. Only tls, ttls and peap are supported.

CACertFile=file

Path to the CA certificate file. Only PEM and DER formats are supported.

PrivateKeyFile=file

Path to the private key file. Only PEM, DER and PFX formats are supported.

PrivateKeyPassphrase=passphrase

Passphrase of the private key.

PrivateKeyPassphraseType=fsid

If specified, use the private key's fsid as the passphrase, and ignore the PrivateKeyPassphrase field.

Identity=identity

Identity string for EAP.

AnonymousIdentity=identity

Anonymous identity string for EAP.

SubjectMatch=substring

Substring to be matched against the subject of the authentication server certificate for EAP.

AltSubjectMatch=substring

Semicolon separated string of entries to be matched against the alternative subject name of the authentication server certificate for EAP.

DomainSuffixMatch=domain

Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for the authentication server certificate for EAP.

DomainMatch=domain

This FQDN is used as a full match requirement for the authentication server certificate for EAP.

Phase2=type

Inner authentication type with for EAP=tls or EAP=ttls. Prefix the value with EAP- to indicate usage of EAP-based authentication method (should only be used with EAP=ttls).

## EXAMPLE

### Eduroam
This is a configuration file for eduroam networks. This file could for example be /var/lib/connman/eduroam.config. Your university's exact settings might be different.

```
[service_eduroam]
Type = wifi
Name = eduroam
EAP = peap
Phase2 = MSCHAPV2
CACertFile = /etc/ssl/certs/UNIV_CA.crt
```

### Complex networking
This is a configuration file for a network providing EAP-TLS, EAP-TTLS and EAP-PEAP services. The respective SSIDs are tls_ssid, ttls_ssid and peap_ssid and the file name could be /var/lib/connman/complex.config.

Please note that the SSID entry is for hexadecimal encoded SSID (e.g. "SSID = 746c735f73736964"). If your SSID does not contain any exotic character then you should use the Name entry instead (e.g. "Name = tls_ssid").

```
[global]
Name = Example
Description = Example network configuration
[service_tls]
Type = wifi
SSID = 746c735f73736964
EAP = tls
CACertFile = /home/user/.certs/ca.pem
ClientCertFile = /home/user/devlp/.certs/client.pem
PrivateKeyFile = /home/user/.certs/client.fsid.pem
PrivateKeyPassphraseType = fsid
Identity = user
[service_ttls]
Type = wifi
Name = ttls_ssid
EAP = ttls
CACertFile = /home/user/.cert/ca.pem
Phase2 = MSCHAPV2
Identity = user
[service_peap]
Type = wifi
Name = peap_ssid
EAP = peap
CACertFile = /home/user/.cert/ca.pem
Phase2 = MSCHAPV2
Identity = user
[service_home_ethernet]
Type = ethernet
IPv4 = 192.168.1.42/255.255.255.0/192.168.1.1
IPv6 = 2001:db8::42/64/2001:db8::1
MAC = 01:02:03:04:05:06
Nameservers = 10.2.3.4,192.168.1.99
SearchDomains = my.home,isp.net
Timeservers = 10.172.2.1,ntp.my.isp.net
Domain = my.home
[service_home_wifi]
Type = wifi
Name = my_home_wifi
Passphrase = password
IPv4 = 192.168.2.2/255.255.255.0/192.168.2.1
MAC = 06:05:04:03:02:01
[service_vlan]
Type = ethernet
DeviceName = enp4s0.1
IPv4 = 192.168.1.42/255.255.255.0/192.168.1.1
```

## SEE ALSO
connman(8)


connman-vpn-provider.config

title: connman-vpn-provider.config(5)

text:
# connman-vpn-provider.config(5)

## NAME
connection_name.config - ConnMan vpn connection provisioning file

## SYNOPSIS
/var/lib/connman-vpn/connection-name.config

## DESCRIPTION
ConnMan's vpn connections are configured with so called "provisioning files" which reside under /var/lib/connman-vpn/. The files can be named anything, as long as they contain only printable ascii characters, for example letters, numbers and underscores. The file must end with .config. Each VPN connection requires a provisioning file, but multiple connections can be specified in the same file.

## FILE FORMAT
The configuration file consists of sections (groups) of key-value pairs. Lines beginning with a '#' and blank lines are considered comments. Sections are started by a header line containing the section enclosed in '[' and ']', and ended implicitly by the start of the next section or the end of the file. Each key-value pair must be contained in a section.

Description of sections and available keys follows:

### [global]
This section is optional, and can be used to describe the actual file. The two allowed fields for this section are:

Name=name

Name of the network.

Description=description

Description of the network.

### [provider_*]
Each provisioned connection must start with a [provider_*] tag, with * replaced by an unique name within the file. The following fields are mandatory:

Type=OpenConnect | OpenVPN | VPNC | L2TP | PPTP

Specifies the VPN type.

Host=IP

VPN server IP address.

Domain=domain

Domain name for the VPN service.

The following field is optional:

Networks=network/netmask/gateway[,...]

Networks behind the VPN. If all traffic should go through the VPN, this field can be left out. The gateway can be left out. For IPv6 addresses, only the prefix length is accepted as the netmask.

### OpenConnect
The following keys can be used for openconnect(8) networks:

OpenConnect.ServerCert=cert

SHA1 fingerprint of the VPN server's certificate.

OpenConnect.CACert=cert

File containing additional CA certificates in addition to the system trusted certificate authorities.

OpenConnect.ClientCert=cert

Client certificate, if needed by web authentication.

OpenConnect.MTU=mtu

Request mtu from the server as the MTU of the tunnel.

OpenConnect.Cookie=cookie

The resulting cookie of the authentication process. As the cookie lifetime can be very limited, it does not usually make sense to add it into the configuration file.

OpenConnect.VPNHost=host

The final VPN server to use after completing the web authentication. Only usable for extremely simple VPN configurations and should normally be set only via the VPN Agent API.

If OpenConnect.Cookie, OpenConnect.VPNHost or OpenConnect.ServerCert are missing, the VPN Agent will be contacted to supply the information.

### OpenVPN
The following keys are mandatory for openvpn(8) networks:

OpenVPN.CACert=cert

Certificate authority file.

OpenVPN.Cert=cert

Local peer's signed certificate.

OpenVPN.Cert=cert

Local peer's signed certificate.

OpenVPN.Key=key

Local peer's private key.

The following keys are optional for openvpn(8) networks:

OpenVPN.MTU=mtu

MTU of the tunnel.

OpenVPN.NSCertType=client | server

Peer certificate type, either client or server.

OpenVPN.Proto=protocol

Use protocol.

OpenVPN.Port=port

TCP/UDP port number.

OpenVPN.AuthUserPass=true | false

Authenticate on the server using username/password.

OpenVPN.AskPass=file

Get certificate password from file.

OpenVPN.AuthNoCache=true | false

Don't cache AskPass or AuthUserPass value.

OpenVPN.TLSRemote=name

Accept connections only from a host with X509 name or common name equal to name.

OpenVPN.TLSAuth=file

Use file for HMAC authentication.

OpenVPN.TLSAuthDir=direction

Use direction for HMAC authentication direction.

OpenVPN.Cipher=cipher

Use cipher as the cipher.

OpenVPN.Auth=true | false

Use HMAC authentication.

OpenVPN.CompLZO=yes | no | adaptive

Use fast LZO compression.

OpenVPN.RemoteCertTls=client | server

Require that remote certificate is signed based on RFC3280 TLS rules.

OpenVPN.ConfigFile=file

OpenVPN config file for extra options not supported by the OpenVPN plugin.

OpenVPN.DeviceType=tun|tap

Whether the VPN should use a tun (OSI layer 3) or tap (OSI layer 2) device. Defaults to tun if omitted.

### VPNC
The following key is mandatory for vpnc(8) networks:

VPNC.IPSec.ID=id

Group username.

The following keys are optional for vpnc(8) networks:

VPNC.IPSec.Secret=secret

Group password.

VPNC.XAuth.Username=username

Username.

VPNC.XAuth.Password=password

Password.

VPNC.IKE.Authmode=mode

IKE authentication mode.

VPNC.IKE.DHGroup=group

IKE DH group name.

VPNC.PFS=group

Diffie-Hellman group for perfect forward secrecy.

VPNC.Domain=domain

Domain name for authentication.

VPNC.Vendor=vendor

Vendor of the IPSec gateway.

VPNC.LocalPort=port

Local ISAKMP port number to use.

VPNC.CiscoPort=port

Cisco UDP Encapsulation Port.

VPNC.AppVersion=version

Application version to report.

VPNC.NATTMode=mode

NAT-Traversal Method to use.

VPNC.DPDTimeout=timeout

DPD idle timeout.

VPNC.SingleDES=true | false

Enable single DES encryption.

VPNC.NoEncryption=true | false

Enable usage of no encryption for data traffic.

VPNC.DeviceType=tun|tap

Whether the VPN should use a tun (OSI layer 3) or tap (OSI layer 2) device. Defaults to tun if omitted.

### L2TP
The following keys are optional for l2tp (xl2tp.conf(5), pppd(8)) networks:

L2TP.User=user

L2TP username.

L2TP.Password=password

L2TP password.

L2TP.BPS=bps

Max bandwidth to use.

L2TP.TXBPS=bps

Max transmit bandwidth to use.

L2TP.RXBPS=bps

Max receive bandwidth to use.

L2TP.LengthBit=yes | no

Use length bit.

L2TP.Challenge=yes | no

Use challenge authentication.

L2TP.DefaultRoute=route

Add route to the routing tables.

L2TP.FlowBit=yes | no

Use seq numbers.

L2TP.TunnelRWS=size

Window size.

L2TP.Exclusive=yes | no

Use only one control channel.

L2TP.Redial=yes | no

Redial if disconnected.

L2TP.RedialTimeout=timeout

Redial timeout.

L2TP.MaxRedials=count

Maximum amount of redial tries.

L2TP.RequirePAP=yes | no

Require PAP.

L2TP.RequireCHAP=yes | no

Require CHAP.

L2TP.ReqAuth=yes | no

Require authentication.

L2TP.AccessControl=yes | no

Use access control.

L2TP.AuthFile=file

Authentication file location.

L2TP.ListenAddr=address

Listen address.

L2TP.IPSecSaref=yes | no

Listen address.

L2TP.Port=port

UDP port used.

PPPD.EchoFailure=count

Echo failure count.

PPPD.EchoFailure=count

Dead peer check count.

PPPD.EchoInterval=interval

Dead peer check interval.

PPPD.Debug=level

Debug level.

PPPD.RefuseEAP=true | false

Refuse EAP authentication.

PPPD.RefusePAP=true | false

Refuse PAP authentication.

PPPD.RefuseCHAP=true | false

Refuse CHAP authentication.

PPPD.RefuseMSCHAP=true | false

Refuse MSCHAP authentication.

PPPD.RefuseMSCHAP2=true | false

Refuse MSCHAPv2 authentication.

PPPD.NoBSDComp=true | false

Disable BSD compression.

PPPD.NoPcomp=true | false

Disable protocol compression.

PPPD.UseAccomp=true | false

Disable Access/Control compression.

PPPD.NoDeflate=true | false

Disable deflate compression.

PPPD.ReqMPPE=true | false

Require the use of MPPE.

PPPD.ReqMPPE40=true | false

Require the use of MPPE 40 bit.

PPPD.ReqMPPE128=true | false

Require the use of MPPE 128 bit.

PPPD.ReqMPPEStateful=true | false

Allow MPPE to use stateful mode.

PPPD.NoVJ=true | false

No Van Jacobson compression.

### PPTP
The following keys are optional for pptp(8) (see also pppd(8)) networks:

PPTP.User=username

Username.

PPTP.Password=password

Password.

PPPD.EchoFailure=count

Echo failure count.

PPPD.EchoFailure=count

Dead peer check count.

PPPD.EchoInterval=interval

Dead peer check interval.

PPPD.Debug=level

Debug level.

PPPD.RefuseEAP=true | false

Refuse EAP authentication.

PPPD.RefusePAP=true | false

Refuse PAP authentication.

PPPD.RefuseCHAP=true | false

Refuse CHAP authentication.

PPPD.RefuseMSCHAP=true | false

Refuse MSCHAP authentication.

PPPD.RefuseMSCHAP2=true | false

Refuse MSCHAPv2 authentication.

PPPD.NoBSDComp=true | false

Disable BSD compression.

PPPD.NoPcomp=true | false

Disable protocol compression.

PPPD.UseAccomp=true | false

Disable Access/Control compression.

PPPD.NoDeflate=true | false

Disable deflate compression.

PPPD.ReqMPPE=true | false

Require the use of MPPE.

PPPD.ReqMPPE40=true | false

Require the use of MPPE 40 bit.

PPPD.ReqMPPE128=true | false

Require the use of MPPE 128 bit.

PPPD.ReqMPPEStateful=true | false

Allow MPPE to use stateful mode.

PPPD.NoVJ=true | false

No Van Jacobson compression.

## EXAMPLE
This is a configuration file for a VPN providing L2TP, OpenVPN and OpenConnect services. It could, for example, be in the file /var/lib/connman-vpn/example.config.

```
[global]
Name = Example
Description = Example VPN configuration
[provider_l2tp]
Type = L2TP
Name = Connection to corporate network
Host = 1.2.3.4
Domain = corporate.com
Networks = 10.10.30.0/24
L2TP.User = username
[provider_openconnect]
Type = OpenConnect
Name = Connection to corporate network using Cisco VPN
Host = 7.6.5.4
Domain = corporate.com
Networks = 10.10.20.0/255.255.255.0/10.20.1.5,192.168.99.1/24,2001:db8::1/64
OpenConnect.ServerCert = 263AFAB4CB2E6621D12E90182008AEF44AEFA031
OpenConnect.CACert = /etc/certs/certificate.p12
[provider_openvpn]
Type = OpenVPN
Name = Connection to corporate network using OpenVPN
Host = 3.2.5.6
Domain = my.home.network
OpenVPN.CACert = /etc/certs/cacert.pem
OpenVPN.Cert = /etc/certs/cert.pem
OpenVPN.Key = /etc/certs/cert.key
```

## SEE ALSO
connmanctl(1), connman(8), connman-vpn(8)


connman-vpn.conf

title: connman-vpn.conf(5)

summary: ConnMan-VPN configuration file

text:
# connman-vpn.conf(5)

## NAME
connman-vpn.conf - ConnMan-VPN configuration file

## SYNOPSIS
/etc/connman/connman-vpn.conf

## DESCRIPTION
connman-vpn.conf is a configuration file for ConnMan-VPN. The configuration file is optional but it can be used to set up various aspects of ConnMan-VPN's behavior. The location of the file may be changed through use of the --config= argument for connman-vpn(8).

DAC privileges (user, group and supplementary groups) of a VPN binary ran by connman-vpn(8) can be controlled by this configuration. Configuration in connman-vpn.conf is for all VPN types and can be overridden by defining separate configs into /etc/connman/vpn-plugin/ using the plugin name + .conf suffix using the same syntax. For example, for OpenVPN the path to config is /etc/connman/vpn-plugin/openvpn.conf which will override any value in the main configuration.

## FILE FORMAT
The configuration file consists of sections (groups) of key-value pairs. Lines beginning with a '#' and blank lines are considered comments. Sections are started by a header line containing the section enclosed in '[' and ']', and ended implicitly by the start of the next section or the end of the file. Each key-value pair must be contained in a section.

Description of sections and available keys follows:

### [General]
This section is the only mandatory section of the configuration file.

InputRequestTimeout=secs

Set input request timeout. Default is 300 seconds. The request for inputs like passphrase will timeout after certain amount of time. Use this setting to increase the value in case of different user interface designs.

### [DACPrivileges]
This section controls the DAC privileges to use for a VPN binary used by a VPN plugin. DAC privileges that can be set are user, group and supplementary groups.

User=username/uid

User on the system to use for running VPN binary. Username or uid can be used.

Group=groupname/gid

The main group to use for running VPN binary. Group name or gid can be used.

SupplementaryGroups=groupnames/gids

Comma separated list of supplementary groups to set for the VPN binary. Groups can be defined with their names or gid's.

## EXAMPLES
The following example configuration sets InputRequestTimeout to 10 minutes, runs VPNs as user "vpn_user" of group "vpn" with additional supplementary groups "inet" and "net_admin".

```
[General]
InputRequestTimeout = 600
[DACPrivileges]
User = vpn_user
Group = vpn
SupplementaryGroups = inet, net_admin
```

## SEE ALSO
connman(8), connman-vpn(8)


connman.conf

title: connman.conf(5)

summary: ConnMan configuration file

text:
# connman.conf(5)

## NAME
main.conf - ConnMan configuration file

## SYNOPSIS
/etc/connman/main.conf

## DESCRIPTION
main.conf is a configuration file for ConnMan. The configuration file is optional but it can be used to set up various aspects of ConnMan's behavior. The location of the file may be changed through use of the --config= argument for connman(8).

## FILE FORMAT
The configuration file consists of sections (groups) of key-value pairs. Lines beginning with a '#' and blank lines are considered comments. Sections are started by a header line containing the section enclosed in '[' and ']', and ended implicitly by the start of the next section or the end of the file. Each key-value pair must be contained in a section.

Description of sections and available keys follows:

### [General]
This section is the only mandatory section of the configuration file.

InputRequestTimeout=secs

Set input request timeout. Default is 120 seconds The request for inputs like passphrase will timeout after certain amount of time. Use this setting to increase the value in case of different user interface designs.

BrowserLaunchTimeout=secs

Set browser launch timeout. Default is 300 seconds The request for launching a browser for portal pages will timeout after certain amount of time. Use this setting to increase the value in case of different user interface designs.

BackgroundScanning=true | false

Enable background scanning. Default is true. If wifi is disconnected, the background scanning will follow a simple backoff mechanism from 3s up to 5 minutes. Then, it will stay in 5 minutes unless user specifically asks for scanning through a D-Bus call. If so, the mechanism will start again from 3s. This feature activates also the background scanning while being connected, which is required for roaming on wifi. When BackgroundScanning is false, ConnMan will not perform any scan regardless of wifi is connected or not, unless it is requested by the user through a D-Bus call.

UseGatewaysAsTimeservers=true| false

Assume that service gateways also function as timeservers. Default is false.

FallbackTimeservers=server[,...]

List of Fallback timeservers separated by ",". These timeservers are used for NTP sync when there are no timeservers set by the user or by the service, and when UseGatewaysAsTimeservers = false. These can contain a mixed combination of fully qualified domain names, IPv4 and IPv6 addresses.

FallbackNameservers=server[,...]

List of fallback nameservers separated by "," appended to the list of nameservers given by the service. The nameserver entries must be in numeric format, host names are ignored.

DefaultAutoConnectTechnologies=technology[,...]

List of technologies that are marked autoconnectable by default, separated by commas ",". The default value for this entry when empty is ethernet,wifi,cellular. Services that are automatically connected must have been set up and saved to storage beforehand.

DefaultFavoriteTechnologies=technology[,...]

List of technologies that are marked favorite by default, separated by commas ",". The default value for this entry when empty is ethernet. Connects to services from this technology even if not setup and saved to storage.

AlwaysConnectedTechnologies=technology[,...]

List of technoolgies which are always connected regardless of PreferredTechnologies setting (AutoConnect = true). The default value is empty and this feature is disabled unless explicitly enabled in the config file.

PreferredTechnologies=technology[,...]

List of preferred technologies from the most preferred one to the least preferred one separated by commas ",". Services of the listed technology type will be tried one by one in the order given, until one of them gets connected or they are all tried. A service of a preferred technology type in state 'ready' will get the default route when compared to another preferred type further down the list with state 'ready' or with a non-preferred type; a service of a preferred technology type in state 'online' will get the default route when compared to either a non-preferred type or a preferred type further down in the list.

NetworkInterfaceBlacklist=interface[,...]

List of blacklisted network interfaces separated by ",". Found interfaces will be compared to the list and will not be handled by connman, if their first characters match any of the list entries. Default value is vmnet,vboxnet,virbr,ifb.

AllowHostnameUpdates=true | false

Allow connman to change the system hostname. This can happen for example if we receive DHCP hostname option. Default value is true.

AllowDomainnameUpdates=true | false

Allow connman to change the system domainname. This can happen for example if we receive DHCP domainname option. Default value is true.

SingleConnectedTechnology=true | false

Keep only a single connected technology at any time. When a new service is connected by the user or a better one is found according to PreferredTechnologies, the new service is kept connected and all the other previously connected services are disconnected. With this setting it does not matter whether the previously connected services are in 'online' or 'ready' states, the newly connected service is the only one that will be kept connected. A service connected by the user will be used until going out of network coverage. With this setting enabled applications will notice more network breaks than normal. Note this options can't be used with VPNs. Default value is false.

TetheringTechnologies=technology[,...]

List of technologies that are allowed to enable tethering separated by ",". The default value is wifi,bluetooth,gadget. Only those technologies listed here are used for tethering. If one wants to tether ethernet, then add "ethernet" in the list. NOTE that if ethernet tethering is enabled, then a DHCP server is started on all ethernet interfaces. Tethered ethernet should never be connected to corporate or home network as it will disrupt normal operation of these networks. Due to this ethernet is not tethered by default. Do not activate ethernet tethering unless you really know what you are doing.

PersistentTetheringMode=true | false

Restore earlier tethering status when returning from offline mode, re-enabling a technology, and after restarts and reboots. Default value is false.

Enable6to4=true | false

Automatically enable Anycast 6to4 if possible. This is not recommended, as the use of 6to4 will generally lead to a severe degradation of connection quality. See RFC6343. Default value is false (as recommended by RFC6343 section 4.1).

VendorClassID=string

Set DHCP option 60 (Vendor Class ID) to the given string. This option can be used by DHCP servers to identify specific clients without having to rely on MAC address ranges, etc

EnableOnlineCheck=true | false

Enable or disable use of HTTP GET as an online status check. When a service is in a READY state, and is selected as default, ConnMan will issue an HTTP GET request to verify that end-to-end connectivity is successful. Only then the service will be transitioned to ONLINE state. If this setting is false, the default service will remain in READY state. Default value is true.

OnlineCheckIPv4URL=url,OnlineCheckIPv6URL=url

Urls (IPv4 and IPv6 respectively) used during the online status check. Please refer to the README for more detailed information. Default values are http://ipv4.connman.net/online/status.html and http://ipv6.connman.net/online/status.html respectively.

OnlineCheckInitialInterval=secs,OnlineCheckMaxInterval=secs

Range of intervals between two online check requests. Please refer to the README for more detailed information. Default values are 1 and 12 respectively.

EnableOnlineToReadyTransition=true | false

WARNING: Experimental feature!!! In addition to EnableOnlineCheck setting, enable or disable use of HTTP GET to detect the loss of end-to-end connectivity. If this setting is false, when the default service transitions to ONLINE state, the HTTP GET request is no more called until next cycle, initiated by a transition of the default service to DISCONNECT state. If this setting is true, the HTTP GET request keeps beeing called to guarantee that end-to-end connectivity is still successful. If not, the default service will transition to READY state, enabling another service to become the default one, in replacement. Default value is false.

AutoConnectRoamingServices=true | false

Automatically connect roaming services. This is not recommended unless you know you won't have any billing problem. Default value is false.

AddressConflictDetection=true | false

Enable or disable the implementation of IPv4 address conflict detection according to RFC5227. ConnMan will send probe ARP packets to see if an IPv4 address is already in use before assigning the address to an interface. If an address conflict occurs for a statically configured address, an IPv4LL address will be chosen instead (according to RFC3927). If an address conflict occurs for an address offered via DHCP, ConnMan send a DHCP DECLINE once and for the second conflict resort to finding an IPv4LL address. Default value is false.

Localtime=string

Path to localtime file. Defaults to /etc/localtime.

RegdomFollowsTimezone=true | false

Enable regdomain to be changed along timezone changes. With this option set to true each time the timezone changes the first present ISO3166 country code is being read from /usr/share/zoneinfo/zone1970.tab and set as regdom value. Default value is false.

ResolvConf=string

Path to resolv.conf file. If the file does not exist, but intermediate directories exist, it will be created. If this option is not set, it tries to write into /run/connman/resolv.conf and fallbacks to /etc/resolv.conf if it fails (/run/connman does not exist or is not writeable). If you do not want to update resolv.conf, you can set /dev/null.

## EXAMPLE
The following example configuration disables hostname updates and enables ethernet tethering.

```
[General]
AllowHostnameUpdates = false
AllowDomainnameUpdates = false
TetheringTechnologies = ethernet,wifi,bluetooth,gadget
```

## SEE ALSO
connman(8)


conntrackd.conf

package: conntrack-tools

title: conntrackd.conf(5)

text:
# conntrackd.conf(5)

## NAME
conntrackd.conf - configuration file for conntrackd daemon

## DESCRIPTION
conntrackd.conf is the main configuration file for the conntrackd(8) daemon. It is loaded by calling `conntrackd -C conntrackd.conf'.

The format of this file is simple, using brackets for sections and key-value pairs for concrete configuration directives:

```
	section1 {
		option1 value1
		option2 value2
	}
	section2 {
		option3 value3
		subsection1 {
			option4 value4
		}
	}
```

You should consider this file as case-sensitive. Empty lines and lines starting with the '#' character are ignored.

Before starting to develop a new configuration, you may want to learn the concepts behind this technlogy at http://conntrack-tools.netfilter.org/manual.html.

There are complete configuration examples at the end of this man page.

## SYNC
This top-level section defines how conntrackd(8) should handle synchronization with other cluster nodes.

There are 3 main synchronization modes or protocols: NOTRACK, ALARM and FTFW.

There are 3 transport protocols as well: TCP, Multicast and UDP.

You have to choose one synchronization mode and one transport protocol.

Also, there are some general options in this section.

### Mode FTFW
This mode is based on a reliable protocol that performs message tracking. Thus, the protocol can recover from message loss, re-ordering and corruption.

In this synchronization mode you may configure ResendQueueSize, CommitTimeout, PurgeTimeout, ACKWindowSize , DisableExternalCache and StartupResync.

ResendQueueSize <value>

Size of the resend queue (in objects). This is the maximum number of objects that can be stored waiting to be confirmed via acknoledgment. If you keep this value low, the daemon will have less chances to recover state-changes under message omission. On the other hand, if you keep this value high, the daemon will consume more memory to store dead objects. Example: ResendQueueSize 131072

Default is 131072 objects.

CommitTimeout <seconds>

This parameter allows you to set an initial fixed timeout for the committed entries when this node goes from backup to primary. This mechanism provides a way to purge entries that were not recovered appropriately after the specified fixed timeout. If you set a low value, TCP entries in Established states with no traffic may hang. For example, an SSH connection without KeepAlive enabled. Example: CommitTimeout 180

By default, this option is not set (the daemon uses an approximate timeout value calculation mechanism).

PurgeTimeout <seconds>

If the firewall replica goes from primary to backup, the `conntrackd -t command' is invoked in the script. This command schedules a flush of the table in N seconds. This is useful to purge the connection tracking table of zombie entries and avoid clashes with old entries if you trigger several consecutive hand-overs.

Default is 60 seconds.

ACKWindowSize <value>

Set the acknowledgement window size. If you decrease this value, the number of acknowlegdments increases. More acknowledgments means more overhead as conntrackd(8) has to handle more control messages. On the other hand, if you increase this value, the resend queue gets more populated. This results in more overhead in the queue releasing. Example: ACKWindowSize 300

If not set, default window size is 300 (value is based on some practical experiments measuring the cycles spent by the acknowledgment handling with oprofile).

DisableExternalCache <on|off>

This clause allows you to disable the external cache. Thus, the state entries are directly injected into the kernel conntrack table. As a result, you save memory in user-space but you consume slots in the kernel conntrack table for backup state entries. Moreover, disabling the external cache means more CPU consumption. You need a Linux kernel >= 2.6.29 to use this feature. If you are installing conntrackd(8) for first time, please read the user manual and I encourage you to consider using the fail-over scripts instead of enabling this option!

By default, this clause is set off.

StartupResync <on|off>

Order conntrackd to request a complete conntrack table resync against the other node at startup. A single request will be made. This is useful to get in sync with another node which has been running while we were down.

Example: StartupResync on

By default, this clause is set off.

### Mode ALARM
This mode is spamming. It is based on a alarm-based protocol that periodically re-sends the flow state to the backup firewall replicas. This protocol consumes a lot of bandwidth but it resolves synchronization problems fast.

In this synchronization mode you may configure RefreshTime, CacheTimeout, CommitTimeout and PurgeTimeout.

RefreshTime <seconds>

If a conntrack entry is not modified in <= N seconds, then a message is broadcasted. For example, this mechanism may be used to resynchronize nodes that just joined the multicast group. Example: RefreshTime 15

CacheTimeout <seconds>

If we don't receive a notification about the state of an entry in the external cache after N seconds, then remove it. Example: CacheTimeout 180

CommitTimeout <seconds>

Same as in FTFW mode.

PurgeTimeout <seconds>

Same as in FTFW mode.

### Mode NOTRACK
Is the most simple mode as it is based on a best effort replication protocol, ie. unreliable protocol. This protocol sends and receives the state information without performing any specific checking.

In this synchronization mode you may configure DisableInternalCache, DisableExternalCache, CommitTimeout, PurgeTimeout and StartupResync.

DisableInternalCache <on|off>

This clause allows you to disable the internal cache. Thus, the synchronization messages are directly sent through the dedicated link. This option is set off by default.

DisableExternalCache <on|off>

Same as in FTFW mode.

CommitTimeout <seconds>

Same as in FTFW mode.

PurgeTimeout <seconds>

Same as in FTFW mode.

StartupResync <on|off>

Same as in FTFW mode.

### MULTICAST
This section indicates to conntrackd(8) to use multicast as transport mechanism between nodes of the firewall cluster.

Please note you can specify more than one dedicated link. Thus, if one dedicated link fails, the daemon can fail-over to another. Note that adding more than one dedicated link does not mean that state-updates will be sent to all of them. There is only one active dedicated link at a given moment.

The Default keyword indicates that this interface will be selected as the initial dedicated link. You can have up to 4 redundant dedicated links.

Note: use different multicast groups for every redundant link.

Example:

```
	Multicast Default {
		IPv4_address 225.0.0.51
		Group 3781
		IPv4_interface 192.168.100.101
		Interface eth3
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum on
	}
	Multicast {
		IPv4_address 225.0.0.51
		Group 3782
		IPv4_interface 192.168.100.102
		Interface eth4
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum on
	}
```

IPv4_address <address>

Multicast address: The address that you use as destination in the synchronization messages. You do not have to add this IP to any of your existing interfaces. Example: IPv4_address 255.0.0.50

Group <number>

The multicast group that identifies the cluster. Example: Group 3780

If any doubt, do not modify this value.

IPv4_interface <address>

IP address of the interface that you are going to use to send the synchronization messages. Remember that you must use a dedicated link for the synchronization messages. Example: IPv4_interface 192.168.100.100

Interface <name>

The name of the interface that you are going to use to send the synchronization messages. Example: Interface eth2

SndSocketBuffer <number>

This transport protocol sender uses a buffer to enqueue the packets that are going to be transmitted. The default size of this socket buffer is available at /proc/sys/net/core/wmem_default. This value determines the chances to have an overrun in the sender queue. The overrun results in packet loss, thus, losing state information that would have to be retransmitted. If you notice some packet loss, you may want to increase the size of the buffer. The system default size is usually around ~100 KBytes which is fairly small for busy firewalls.

Note: The NOTRACK protocol is best effort, it is really recommended to increase the buffer size.

Example: SndSocketBuffer 1249280

RcvSocketBuffer <number>

This transport protocol receiver uses a buffer to enqueue the packets that the socket is pending to handle. The default size of this socket buffer is available at /proc/sys/net/core/rmem_default. This value determines the chances to have an overrun in the receiver queue. The overrun results in packet loss, thus, losing state information that would have to be retransmitted. If you notice some packet loss, you may want to increase the size of the buffer. The system default size is usually around ~100 KBytes which is fairly small for busy firewalls.

Note: The NOTRACK protocol is best effort, it is really recommended to increase the buffer size.

Example: RcvSocketBuffer 1249280

Checksum <on|off>

Enable/Disable message checksumming. This is a good property to achieve fault-tolerance. In case of doubt, use it.

### UDP
This section indicates to conntrackd(8) to use UDP as transport mechanism between nodes of the firewall cluster.

As in the Multicast configuration, you may especify several fail-over dedicated links using the Default keyword.

Example:

```
	UDP {
		IPv4_address 172.16.0.1
		IPv4_Destination_Address 172.16.0.2
		Port 3781
		Interface eth3
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum on
	}
```

IPv4_address <address>

UDP IPv4 address that this firewall uses to listen to events. Example: IPv4_address 192.168.2.100

IPv6_address <address>

UDP IPv6 address that this firewall uses to listen to events. Example: IPv6_address fe80::215:58ff:fe28:5a27

IPv4_Destination_Address <address>

Destination IPv4 UDP address that receives events, ie. the other firewall's dedicated link address. Example: IPv4_Destination_Address 192.168.2.101

IPv6_Destionation_Address <address>

Destination IPv6 UDP address that receives events, ie. the other firewall's dedicated link address. Example: IPv6_Destination_Address fe80::2d0:59ff:fe2a:775c

Port <number>

UDP port used Example: Port 3780

Interface <name>

Same as in the Multicast transport protocol configuration.

SndSocketBuffer <number>

Same as in the Multicast transport protocol configuration.

RcvSocketBuffer <number>

Same as in the Multicast transport protocol configuration.

Checksum <on|off>

Same as in the Multicast transport protocol configuration.

### TCP
You can also use Unicast TCP to propagate events.

If you combine this transport with the NOTRACK mode, it becomes reliable.

The TCP transport protocol can be configured in exactly the same way as the UDP transport protocol.

As in the Multicast configuration, you may especify several fail-over dedicated links using the Default keyword.

Example:

```
	TCP {
		IPv6_address fe80::215:58ff:fe28:5a27
		IPv6_Destination_Address fe80::215:58ff:fe28:5a27
		Port 3781
		Interface eth2
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum on
	}
```

### OPTIONS
Other unsorted options that are related to the synchronization protocol or transport mechanism.

TCPWindowTracking <on|off>

TCP state-entries have window tracking disabled by default, you can enable it with this option. As said, default is off. This feature requires a Linux kernel >= 2.6.36.

ExpectationSync <on|{ list }>

Set this option on if you want to enable the synchronization of expectations. You have to specify the list of helpers that you want to enable. This feature requires a Linux kernel >= 3.5.

Example, sync all expectations:

```
	ExpectationSync on
```

Example, sync given expectations:

```
	ExpectationSync {
		ftp
		ras
		q.931
		h.245
		sip
	}
```

By default, this option is disabled.

## GENERAL
This top-level section contains generic configuration directives for the conntrackd(8) daemon.

Systemd <on|off>

Enable systemd(1) runtime support if conntrackd(8) is compiled with the proper configuration. Then you can use a service unit of Type=notify. Obviously, this requires the init of your system to be systemd(1).

Note: systemd(1) watchdog is supported as well.

Example: Systemd on

By default runtime support is enabled if conntrackd was built with the systemd feature. Otherwise is off.

Nice <value>

Deprecated. Conntrackd ignores this option and it will be removed in the future. Please note that you can run nice(1) and renice(1) externally. Also note that conntrackd(8) now uses by default a RT scheduler.

HashSize <value>

Number of buckets in the cache hashtable. The bigger it is, the closer it gets to O(1) at the cost of consuming more memory. Read some documents about tuning hashtables for further reference. Example: HashSize 32768

HashLimit <value>

Maximum number of conntracks, it should be double of /proc/sys/net/netfilter/nf_conntrack_max since the daemon may keep some dead entries cached for possible retransmission during state synchronization. Example: HashLimit 131072

LogFile <on|off|filename>

Enable conntrackd(8) to log to a file. Example: LogFile on

Default is off. The default logfile is /var/log/conntrackd.log.

Syslog <on|off|facility>

Enable connection logging via Syslog. If you set the facility, use the same as in the Stats section, otherwise you'll get a warning message. Example: Syslog local0

Default is off.

Lockfile <filename>

Lockfile to be used by conntrackd(8) (absolute path). Example: LockFile /var/lock/conntrack.lock

Default is /var/lock/conntrack.lock.

NetlinkBufferSize <value>

Netlink event socket buffer size. If you do not specify this clause, the default buffer size value in /proc/sys/net/core/rmem_default is used. This default value is usually around 100 Kbytes which is fairly small for busy firewalls. This leads to event message dropping and high CPU consumption. Example: NetlinkBufferSize 2097152

NetlinkBufferSizeMaxGrowth <value>

The daemon doubles the size of the netlink event socket buffer size if it detects netlink event message dropping. This clause sets the maximum buffer size growth that can be reached. Example: NetlinkBufferSizeMaxGrowth 8388608

NetlinkOverrunResync <on|off|value>

If the daemon detects that Netlink is dropping state-change events, it automatically schedules a resynchronization against the Kernel after 30 seconds (default value). Resynchronizations are expensive in terms of CPU consumption since the daemon has to get the full kernel state-table and purge state-entries that do not exist anymore. Note: Be careful of setting a very small value here.

Example: NetlinkOverrunResync on

The default value is 30 seconds. If not specified, the daemon assumes that this option is enabled and uses the default value.

NetlinkEventsReliable <on|off>

If you want reliable event reporting over Netlink, set on this option. If you set on this clause, it is a good idea to set off NetlinkOverrunResync. You need Linux Kernel >= 2.6.31 for this option to work.

Example: NetlinkEventsReliable on

This option is off by default.

PollSecs <seconds>

By default, the daemon receives state updates following an event-driven model. You can modify this behaviour by switching to polling mode with this clause. This clause tells conntrackd(8) to dump the states in the kernel every N seconds. With regards to synchronization mode, the polling mode can only guarantee that long-lifetime states are recovered. The main advantage of this method is the reduction in the state replication at the cost of reducing the chances of recovering connections.

Example: PollSecs 15

EventIterationLimit <value>

The daemon prioritizes the handling of state-change events coming from the core. With this clause, you can set the maximum number of state-change events (those coming from kernel-space) that the daemon will handle after which it will handle other events coming from the network or userspace. A low value improves interactivity (in terms of real-time behaviour) at the cost of extra CPU consumption.

Example: EventIterationLimit 100

Default (if not set) is 100.

### UNIX
Unix socket configuration. This socket is used by conntrackd(8) to listen to external commands like `conntrackd -k' or `conntrackd -n'.

Example:

```
	UNIX {
		Path /var/run/conntrackd.ctl
	}
```

Path <filename>

Absolute path to the Unix socket. Example: Path /var/run/conntrackd.ctl

Backlog <value>

Deprecated option.

### FILTER
Event filtering. This clause allows you to filter certain traffic.

There are currently three filter-sets: Protocol, Address and State. The filter is attached to an action that can be: Accept or Ignore. Thus, you can define the event filtering policy of the filter-sets in positive or negative logic depending on your needs.

You can select if conntrackd(8) filters the event messages from user-space or kernel-space. The kernel-space event filtering saves some CPU cycles by avoiding the copy of the event message from kernel-space to user-space. The kernel-space event filtering is prefered, however, you require a Linux kernel >= 2.6.29 to filter from kernel-space.

The syntax for this section is: Filter From <from> { }.

If you want to select kernel-space event filtering, use the keyword Kernelspace instead of Userspace.

Example:

```
	Filter From Userspace {
		Protocol Accept {
			TCP
			SCTP
			DCCP
		}
		Address Ignore {
			IPv4_address 127.0.0.1
			IPv6_address ::1
		}
		State Accept {
			ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT for TCP
		}
	}
```

Protocol <policy> { <protocols list> }

Accept only certain protocols: You may want to replicate the state of flows depending on their layer 4 protocol. Policy is one of Accept or Ignore.

Protocols are: TCP, SCTP, DCCP, UDP, ICMP and IPv6-ICMP.

The ICMP and IPv6-ICMP protocols require a Linux kernel >= 2.6.31.

Example:

```
	Protocol Accept {
		TCP
		SCTP
		DCCP
	}
```

Address <policy> { <addresses list> }

Ignore traffic for a certain set of IP's: Usually all the IP assigned to the firewall since local traffic must be ignored, only forwarded connections are worth to replicate. Note that these values depends on the local IPs that are assigned to the firewall.

You may specify several IPv4_address and/or IPv6_address directives. You can also specify networks in CIDR format.

Policy is one of Accept or Ignore.

Example:

```
	Address Ignore {
		IPv4_address 127.0.0.1 # loopback
		IPv4_address 192.168.0.100 # virtual IP 1
		IPv4_address 192.168.1.100 # virtual IP 2
		IPv4_address 192.168.100.100 # dedicated link ip
		IPv4_address 192.168.0.0/24
		IPv6_address ::1
	}
```

State <policy> { <states list> for TCP }

Filter by flow state. This option introduces a trade-off in the replication: it reduces CPU consumption at the cost of having lazy backup firewall replicas. Note: only affects TCP flows.

The existing TCP states are: SYN_SENT, SYN_RECV, ESTABLISHED, FIN_WAIT, CLOSE_WAIT, LAST_ACK, TIME_WAIT, CLOSED and LISTEN.

Policy is one of Accept or Ignore.

Example:

```
	State Accept {
		ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT for TCP
	}
```

### SCHEDULER
Select a different scheduler for the daemon, you can select between RR and FIFO and the process priority.

Using a RT scheduler reduces the chances to overrun the Netlink buffer and conntrackd(8) uses by default RR unless FIFO is selected. See sched_setscheduler(2) for more information.

Example:

```
	Scheduler {
		Type FIFO
		Priority 99
	}
```

Type <type>

Supported values are RR or FIFO. Default: RR

Priority <value>

Value of the scheduler priority. Minimum is 0, maximum is 99. Default: 99 (as returned by sched_get_priority_max(2) for SCHED_RR)

## STATS
This top-level section indicates conntrackd(8) to work as a statistic collector for the nf_conntrack linux kernel subsystem.

LogFile <on|off|filename>

If you enable this option, the daemon writes the information about destroyed connections to a logfile. Default is off. Default filename is /var/log/conntrackd-stats.log.

NetlinkEventsReliable <on|off>

If you want reliable event reporting over Netlink, set on this option. If you set on this clause, it is a good idea to set off NetlinkOverrunResync. This requires Linux kernel >= 2.6.31. Default is off.

Syslog <on|off|facility>

Enable connection logging via Syslog. If you set the facility, use the same as in the General section, otherwise you'll get a warning message. Example: Syslog local0

Default is off.

## HELPER
Note: this configuration is very advanced and has nothing to do with synchronization or stats collection.

This top-level section indicates conntrackd(8) to inject user-space helpers into the nf_conntrack linux kernel subsystem. It will result in the nf_conntrack engine sending connections to userspace for further processing.

Before this, you have to make sure you have registered the given user-space helper stub.

Example:

```
	% nfct add helper ftp inet tcp
```

Each user-space helper should be registered using a Type section, which are named this way:

```
	Type <name> <af> <transport>
```

Examples:

```
Helper {
	Type ftp inet tcp {
		QueueNum 0
		QueueLen 10240
		Policy ftp {
			ExpectMax 1
			ExpectTimeout 300
		}
	}
	Type rpc inet tcp {
		QueueNum 1
		QueueLen 10240
		Policy rpc {
			ExpectMax 1
			ExpectTimeout 300
		}
	}
	Type rpc inet udp {
		QueueNum 2
		QueueLen 10240
		Policy rpc {
			ExpectMax 1
			ExpectTimeout 300
		}
	}
	Type tns inet tcp {
		QueueNum 3
		QueueLen 10240
		Policy tns {
			ExpectMax 1
			ExpectTimeout 300
		}
	}
	Type dhcpv6 inet6 udp {
		QueueNum 4
		QueueLen 10240
		Policy dhcpv6 {
			ExpectMax 1
			ExpectTimeout 300
		}
	}
	Type ssdp inet udp {
		QueueNum 5
		QueueLen 10240
		Policy ssdp {
			ExpectMax 1
			ExpectTimeout 300
		}
	}
}
```

Parameters inside the Type section:

QueueNum <number>

Set NFQUEUE number you want to use to receive traffic from the kernel. Example: QueueNum 0

QueueLen <number>

Maximum number of packets waiting in the queue to receive a verdict from user-space. Rise value if you hit the following error message:

```
	"nf_queue: full at X entries, dropping packet(s)"
```

Default is 1024.

Example: QueueLen 10240

Policy <name> { }

Set the expectation policy for the given helper. This sub-section contains 2 directives: ExpectMax <number> (maximum number of simultaneous expectations) and ExpecTimeout <seconds> (maximum living time for one expectation).

## COMPLETE EXAMPLES
Find below some real-life working examples.

### STATS EXAMPLE
This configuration example tells conntrackd(8) to work as a stats collector.

```
Stats {
	LogFile on
	NetlinkEventsReliable Off
	Syslog off
}
General {
	Systemd on
	HashSize 8192
	HashLimit 65535
	Syslog on
	LockFile /var/lock/conntrack.lock
	UNIX {
		Path /var/run/conntrackd.ctl
	}
	NetlinkBufferSize 262142
	NetlinkBufferSizeMaxGrowth 655355
	Filter {
		Protocol Accept {
			TCP
			UDP
		}
		Address Ignore {
			IPv4_address 127.0.0.1
			IPv6_address ::1
		}
	}
}
```

### SYNC EXAMPLE 1
This example configures synchronization in FTFW mode with Multicast transport.

It includes common general configuration as well.

Note: this is one of the recommended setups for conntrackd(8) in a firewall cluster environment.

```
Sync {
	Mode FTFW {
		ResendQueueSize 131072
		PurgeTimeout 60
		ACKWindowSize 300
		DisableExternalCache Off
	}
	Multicast {
		IPv4_address 225.0.0.50
		Group 3780
		IPv4_interface 192.168.100.100
		Interface eth2
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum on
	}
	Multicast Default {
		IPv4_address 225.0.0.51
		Group 3781
		IPv4_interface 192.168.100.101
		Interface eth3
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum on
	}
	Options {
		TCPWindowTracking Off
		ExpectationSync On
	}
}
General {
	Systemd on
	HashSize 32768
	HashLimit 131072
	LogFile on
	Syslog off
	LockFile /var/lock/conntrack.lock
	UNIX {
		Path /var/run/conntrackd.ctl
	}
	NetlinkBufferSize 2097152
	NetlinkBufferSizeMaxGrowth 8388608
	NetlinkOverrunResync On
	NetlinkEventsReliable Off
	EventIterationLimit 100
	Filter From Userspace {
		Protocol Accept {
			TCP
			SCTP
			DCCP
		}
		Address Ignore {
			IPv4_address 127.0.0.1
			IPv4_address 192.168.100.0/24
			IPv6_address ::1
		}
	}
}
```

### SYNC EXAMPLE 2
This example configures synchronization in NOTRACK mode with TCP transport.

It includes common general configuration as well.

```
Sync {
	Mode NOTRACK {
		DisableInternalCache on
		DisableExternalCache on
	}
	TCP {
		IPv4_address 192.168.2.100
		IPv4_Destination_Address 192.168.2.101
		Port 3780
		Interface eth2
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum on
	}
	Options {
		TCPWindowTracking Off
		ExpectationSync On
	}
}
General {
	Systemd on
	HashSize 32768
	HashLimit 131072
	LogFile on
	Syslog off
	LockFile /var/lock/conntrack.lock
	UNIX {
		Path /var/run/conntrackd.ctl
	}
	NetlinkBufferSize 2097152
	NetlinkBufferSizeMaxGrowth 8388608
	NetlinkOverrunResync On
	NetlinkEventsReliable Off
	EventIterationLimit 100
	Filter From Userspace {
		Protocol Accept {
			TCP
			SCTP
			DCCP
		}
		Address Ignore {
			IPv4_address 127.0.0.1
			IPv4_address 192.168.0.0/16
			IPv6_address ::1
		}
		State Accept {
			ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT for TCP
		}
	}
}
```

## SEE ALSO
conntrackd(8), conntrack(8), nfct(8), http://conntrack-tools.netfilter.org/manual.html

## AUTHOR
Pablo Neira Ayuso wrote and maintains the conntrackd tool.

This manual page was written by Arturo Borrero Gonzalez <arturo@debian.org> based on the conntrackd tarball config examples.

Please send bug reports to <netfilter-devel@lists.netfilter.org>. Subscription is required.

This documentation is free/libre under the terms of the GPLv2+.


conserver.cf

package: conserver

title: conserver.cf(5)

summary: console configuration file for

text:
# conserver.cf(5)

## NAME
conserver.cf - console configuration file for conserver(8)

## DESCRIPTION
The format of the conserver.cf file is made up of named blocks of keyword/value pairs, comments, and optional whitespace for formatting flexibility. The block types as well as the keywords are pre-defined and explained in the BLOCKS section. A comment is an unquoted pound-sign to a newline. See the PARSER section for full details on whitespace and quoting.

Let me first show you a sample block with a couple of keyword/value pairs to make the description a bit simpler to understand.

```
console simple { master localhost; type exec; rw *; }
```

This is actually a fully functional conserver.cf file (if certain conditions are met...and if you can list those conditions, you can probably can skip to the BLOCKS section).

Our example is made of up of a console-block named ``simple'' with three keyword/value pairs. What this does is define a console named ``simple'', makes the master of that console the host ``localhost'', makes the type an exec-style console, and gives every user read/write permission. This is the generic format of the file:

```
block-type block-name { keyword value; ... }
```

To show the addition of comments and whitespace, here is the example reformatted (but functionally equivalent):

```
# define a console named "simple"
console simple {

    # setting all required values...

    master localhost;

    type exec;  # exec-style console

    rw *;       # allow any username
}
```

## PARSER
The parser has six characters that it considers special. These are: ``{'', ``}'', ``;'', ``#'', ``\'', and ``"''. The first three (hereby called tokens) define the format of the configuration blocks and are used as word separators, the next is the comment character, and the last two are quoting characters.

Word separation occurs when the parser encounters an unquoted token and, in certain cases, whitespace. Whitespace is only used as a word separator when the parser is looking for a block-type or keyword. When it's looking for a block-name or value, whitespace is like any other character, which allows you to embed whitespace in a block-name or value without having to quote it. Here is an example:

```
default my defs { rw *; include other defs  ; }
```

The block-type is ``default'', the block-name is ``my defs'', and the value for the keyword ``include'' is ``other defs''. Whitespace around tokens are ignored so you get ``other defs'' instead of ``other defs '' as the value.

The only way to use one of the special characters as part of a block-name or value is to quote it.

Quoting is a simple matter of prefixing a character with a backslash or surrounding a group of characters with double-quotes. If a character is prefixed by a backslash, the next character is a literal (so ``\\'' produces a ``\'', ``\"'' produces ``"'', ``\{'' produces a ``{'', etc.). For double-quoted strings, all characters are literal except for ``\"'', which embeds a double-quote.

Adding a variety of quotes to our example without changing the meaning of things, we have:

```
"defa"ult my\ defs { rw *; in\clude "other defs"  ; }
```

There is one special line the parser recognizes: a ``#include'' statement. It is of the form:

\#include filename

Any whitespace around filename is ignored, but whitespace embedded inside is preserved. Everything in filename is taken literally, so none of the normal parser quoting applies. The #include must begin in ``column 0'' - no whitespace is allowed between it and the start of the physical line. There is an include file depth limit of 10 to prevent infinite recursion.

## BLOCKS
access hostname|ipaddr

Define an access block for the host named hostname or using the address ipaddr. If the value of ``*'' is used, the access block will be applied to all conserver hosts. Access lists are used in a first match fashion (top down), so order is important.

admin [!]username[,...]|""

Define a list of users making up the admin list for the console server. If username matches a previously defined group name, all members of the previous group are applied to the admin list (with access reversed if prefixed with a `!'). If username doesn't match a previously defined group and username begins with `@', the name (minus the `@') is checked against the host's group database. All users found in the group will be granted (or denied, if prefixed with `!') access. If username doesn't match a previous group and doesn't begin with `@', the users will be granted (or denied, if prefixed with `!') access. If the null string (``""'') is used, any users previously defined for the console servers's admin list are removed.

allowed hostname[,...]

The list of hostnames are added to the ``allowed'' list, which grants connections from the hosts but requires username authentication.

include accessgroup

The access lists defined using the name accessgroup are applied to the current access block. The included access block must be previously defined.

limited [!]username[,...]|""

Define a list of users with limited functionality on the console server. These users will not be allowed to suspend their connection, shift to another console, or attach to a local command. If username matches a previously defined group name, all members of the previous group are applied to the admin list (with access reversed if prefixed with a `!'). If username doesn't match a previously defined group and username begins with `@', the name (minus the `@') is checked against the host's group database. All users found in the group will be granted (or denied, if prefixed with `!') access. If username doesn't match a previous group and doesn't begin with `@', the users will be granted (or denied, if prefixed with `!') access. If the null string (``""'') is used, any users previously defined for the console server's limited list are removed.

rejected hostname[,...]

The list of hostnames are added to the ``rejected'' list, which rejects connections from the hosts.

trusted hostname[,...]

The list of hostnames are added to the ``trusted'' list, which grants connections from the hosts without username authentication.

break n

Define a break sequence where (1 <= n <= 9) or (a <= n <= z). Break sequences are accessed via the ``^Ecln'' client escape sequence.

confirm yes|true|on|no|false|off

Set whether or not to ask the client for confirmation before sending the break sequence. The default is ``no''.

delay n

Set the time delay for the \d sequence to n milliseconds. The default time delay is 250ms.

string breakseq

Assign the string breakseq to the specified slot n. A break sequence is a simple character string with the exception of `\' and `^':

\a

alert

\b

backspace

\d

delay specified by the delay option.

\f

form-feed

\n

newline

\r

carriage-return

\t

tab

\v

vertical-tab

\z

serial break

\\

backslash

\^

circumflex

\ooo

octal representation of a character (where ooo is one to three octal digits)

\c

character c

^?

delete

^c

control character (c is ``and''ed with 0x1f)

config hostname|ipaddr

Define a configuration block for the host named hostname or using the address ipaddr. If the value of ``*'' is used, the configuration block will be applied to all conserver hosts.

autocomplete yes|true|on|no|false|off

Turn the console name autocompletion feature on or off. If autocompletion is on, a client can use any unique leading portion of a console name when connecting to a console. Autocompletion is on by default.

defaultaccess rejected|trusted|allowed

Set the default access permission for all hosts not matched by an access list (see the -a command-line flag).

daemonmode yes|true|on|no|false|off

Set whether or not to become a daemon when run (see the -d command-line flag).

initdelay number

Set the number of seconds between console initializations. All consoles with the same host value will be throttled as a group (those without a host value are their own group). In other words, each console within a group will only be initialized after number seconds passes from the previous initialization of a console in that group. Different throttle groups are initialized simultaneously. One warning: since consoles are split up and managed by seperate conserver processes, it's possible for more than one conserver process to have a throttle group based on a particular host value. If this happens, each conserver process will throttle their groups independently of the other conserver processes, which results in a more rapid initialization (per host value) than one might otherwise expect. If number is zero, all consoles are initialized without delay.

logfile filename

Set the logfile to write to when in daemon mode (see the -L command-line flag).

passwdfile filename

Set the password file location used for authentication (see the -P command-line flag).

primaryport number|name

Set the port used by the master conserver process (see the -p command-line flag).

redirect yes|true|on|no|false|off

Turn redirection on or off (see the -R command-line flag).

reinitcheck number

Set the number of minutes used between reinitialization checks (see the -O command-line flag).

secondaryport number|name

Set the base port number used by child processes (see the -b command-line flag).

setproctitle yes|true|on|no|false|off

Set whether or not the process title shows master/group functionality as well as the port number the process is listening on and how many consoles it is managing. The operating system must support the setproctitle() call.

sslcredentials filename

Set the SSL credentials file location (see the -c command-line flag).

sslcacertificatefile filename

Load the valid CA certificates for the SSL connection from the PEM encoded file. This option overrides the global CA list.

sslreqclientcert yes|true|on|no|false|off

Set whether or not a certificate is required by the client to connect. The default is ``no''.

sslrequired yes|true|on|no|false|off

Set whether or not encryption is required when talking to clients (see the -E command-line flag).

unifiedlog filename

Set the location of the unified log to filename. See the -U command-line flag for details.

console name

Define a console identified as name. The keywords are the same as the default block with the following addition.

aliases name[,...]|""

Define a list of console aliases. If the null string (``""'') is used, any aliases previously defined for the console are removed.

default name

Define a block of defaults identified as name. If name is ``*'', the automatically applied default block is defined (basically all consoles have an implicit ``include "*";'' at the beginning of their definition).

baud 300|600|1800|2400|4800|9600|19200|38400|57600|115200

Assign the baud rate to the console. Only consoles of type ``device'' will use this value.

break n

Assign the break sequence n as the default for the console, which is used by the ``^Ecl0'' client escape sequence.

breaklist n[,...]|""

Associate a list of break sequences referenced by n with the console. If ``*'' is used (the default), all defined break sequences will be available. If the null string (``""'') is used, no sequences will be available.

device filename

Assign the serial device filename as the path to the console. Only consoles of type ``device'' will use this value.

devicesubst c=t[n]f[,...]|""

Perform character substitutions on the device value. A series of replacements can be defined by specifying a comma-separated list of c=t[n]f sequences where c is any printable character, t specifies the replacement value, n is a field length (optional), and f is the format string. t can be one of the characters below, catagorized as a string replacement or a numeric replacement, which dictates the use of the n and f fields.

String Replacement

c

console name

h

host value

r

replstring value

Numeric Replacement

p

config port value

P

calculated port value

For string replacements, if the replacement isn't at least n characters, it will be padded with space characters on the left. f must be `s'. For numeric replacements, the value will be formatted to at least n characters, padded with 0s if n begins with a 0, and space characters otherwise. f must be either `d', `x', `X', `a', or `A', specifying a decimal, lowercase hexadecimal (0-9a-f), uppercase hexadecimal (0-9A-F), lowercase alphanumeric (0-9a-z), or uppercase alphanumeric (0-9A-Z) conversion. If the null string (``""'') is used, no replacements will be done.

exec command|""

Assign the string command as the command to access the console. Conserver will run the command by invoking ``/bin/sh -ce "command"''. If the null string (``""'') is used or no exec keyword is specified, conserver will use the command ``/bin/sh -i''. Only consoles of type ``exec'' will use this value.

execrunas [user][:group]|""

By default, the command invoked by exec is run with the same privileges as the server. If the server is running with root privileges, this option resets the user and/or group of the invoked process to user and group respectively. user may be a username or numeric uid and group may be a group name or numeric gid. Either one is optional. If the server is not running with root privileges, these values are not used. If the null string (``""'') is specified, the default of running with the same privileges as the server is restored.

execsubst c=t[n]f[,...]|""

Perform character substitutions on the exec value. See the devicesubst option for an explanation of the format string. If the null string (``""'') is used, no replacements will be done.

host hostname

Assign hostname as the host to connect to for accessing the console. You must also set the port option for consoles of type ``host''. Normally, only consoles of type ``host'' and ``ipmi'' will use this value, however if the devicesubst, execsubst, or initsubst keywords are used in any console type, this value is used.

idlestring string|""

Assign the string that is sent to the console once the console is idle for an idletimeout amount of time. If the null string (``""'') is used, the string is unset and the default is used. The string is interpreted just as a break string is interpreted (see the break configuration items for details) where all delays specified (via ``\d'') use the default delay time. The default string is ``\n''.

idletimeout number[s|m|h]

Set the idle timeout of the console to number seconds. If an `s', `m', or `h' is used after number, the specified time is interpreted as seconds, minutes, or hours. Set the timeout to zero to disable the idle timeout (the default).

ipmiciphersuite number

Set the IPMI cipher suite. Syntactically valid values are -1 (the default) and greater. Check the FreeIPMI documentation for usable values.

ipmikg string|""

Set the BMC authentication key K_g to string. A K_g value is a simple character string with the exception of `\':

\\

backslash

\ooo

octal representation of a character (where ooo is one to three octal digits)

\c

character c

The resulting value must be no more than 20 characters. The null string (``""'') is the default.

impiworkaround [!]option[,...]|""

You can turn off a workaround by prefixing it with a ``!'' character. So, to turn off the integrity workaround, you would use !integrity. The following are valid options and their mapping to FreeIPMI settings:

activation-status

SKIP_SOL_ACTIVATION_STATUS

auth-capabilites

AUTHENTICATION_CAPABILITIES

channel-payload

SKIP_CHANNEL_PAYLOAD_SUPPORT

checksum

NO_CHECKSUM_CHECK

default

DEFAULT

ignore-payload-size

IGNORE_SOL_PAYLOAD_SIZE

ignore-port

IGNORE_SOL_PORT

integrity

NON_EMPTY_INTEGRITY_CHECK_VALUE

intel-session

INTEL_2_0_SESSION

packet-sequence

INCREMENT_SOL_PACKET_SEQUENCE

privilege

OPEN_SESSION_PRIVILEGE

serial-alerts

SERIAL_ALERTS_DEFERRED

sun-session

SUN_2_0_SESSION

supermicro-session

SUPERMICRO_2_0_SESSION

If no ipmiworkaround is specified, the ``default'' workaround will be used. The null string (``""'') unsets all workarounds, including ``default''. See the FreeIPMI documentation for details on what workarounds affect.

ipmiprivlevel user|operator|admin

Set the privilege level for the username used during IPMI authentication. The default privilege level is ``admin''.

include default

The default block defined using the name default is applied to the current console or default block. The included default block must be previously defined.

initcmd command|""

Invoke command as soon as the console is brought up, redirecting the console to stdin, stdout, and stderr of command. The command is passed as an argument to ``/bin/sh -ce''. If the null string (``""'') is used, the command is unset and nothing is invoked.

initrunas [user][:group]|""

By default, the command invoked by initcmd is run with the same privileges as the server. If the server is running with root privileges, this option resets the user and/or group of the invoked process to user and group respectively. user may be a username or numeric uid and group may be a group name or numeric gid. Either one is optional. If the server is not running with root privileges, these values are not used. If the null string (``""'') is specified, the default of running with the same privileges as the server is restored.

initspinmax n|""

Set the maximum number of ``spins'' allowed for the console to n, where 0 <= n <= 254. A console is determined to be ``spinning'' if an attempt to initialize the console occurs in under initspintimer seconds from its previous initialization and this quick initialization occurs initspinmax times in a row. If, at any point, the time between initializations is greater than initspintimer, the counter for reaching initspinmax resets to zero. When a console is determined to be ``spinning'' it is forced down. If the null string (``""'') is specified, the default of 5 is used.

initspintimer t|""

Set the number of seconds a console must be ``up'' to not be considered ``spinning'' to t, where 0 <= t <= 254. See initspinmax for a full description of console ``spinning.'' If the null string (``""'') is specified, the default of 1 is used.

initsubst c=t[n]f[,...]|""

Perform character substitutions on the initcmd value. See the devicesubst option for an explanation of the format string. If the null string (``""'') is used, no replacements will be done.

logfile filename|""

Assign the logfile specified by filename to the console. Any occurrence of ``&'' in filename will be replaced with the name of the console. If the null string (``""'') is used, the logfile name is unset and no logging will occur.

logfilemax number[k|m]

Enable automatic rotation of logfile once its size exceeds number bytes. Specifying k or m interpret number as kilobytes and megabytes. number must be at least 2048 bytes. A value of zero will turn off automatic rotation of logfile. The logfile filename will be renamed filename-YYYYMMDD-HHMMSS, where the extension is the current GMT year, month, day, hour, minute, and second (to prevent issues with clock rollbacks). File sizes are checked every 5 minutes with an additional initial pseudo-random delay of up to one minute (to help prevent all processes checking all consoles simultaneously). 2.5% (minimum 100 bytes, maximum 4000 bytes) of the old logfile is read from the end of the file. All data past the first newline is moved (not copied) to the new logfile so that a replay of the console works and starts on a line boundary.

master hostname|ipaddr

Define which conserver host manages the console. The host may be specified by hostname or using the address ipaddr.

motd message|""

Set the "message of the day" for the console to message, which gets displayed when a client attaches to the console. If the null string (``""'') is used, the MOTD is unset and no message will occur.

options [!]option[,...]|""

You can negate the option by prefixing it with a ``!'' character. So, to turn off the hupcl flag, you would use !hupcl. The following are valid options:

ixon

Enable XON/XOFF flow control on output. Only consoles of type ``device'' or ``exec'' will use this value. Default is ixon.

ixany

Enable any character to restart output. Only consoles of type ``device'' or ``exec'' will use this value. Default is !ixany.

ixoff

Enable XON/XOFF flow control on input. Only consoles of type ``device'' or ``exec'' will use this value. Default is ixoff for consoles of type ``device'' and !ixoff for consoles of type ``exec''.

crtscts

Enable RTS/CTS (hardware) flow control. Only consoles of type ``device'' will use this value. Default is !crtscts.

cstopb

Set two stop bits, rather than one. Only consoles of type ``device'' will use this value. Default is !cstopb.

hupcl

Lower modem control lines after last process closes the device (hang up). Only consoles of type ``device'' will use this value. Default is !hupcl.

ondemand

Initialize the console when a client requests a connection to the console. When no clients are connected, bring the console down. The conserver option -i will set this flag for all consoles. Default is !ondemand.

striphigh

Strip the high bit off all data coming from this console and all clients connected to this console before processing occurs. The conserver option -7 will set this flag for all consoles. Default is !striphigh.

reinitoncc

Automatically reinitialize (``bring up'') a downed console when a client connects. Without this option, a client will be attached to the downed console and will need to manually reinitialize the console with an escape sequence. The conserver option -o will set this flag for all consoles. Default is !reinitoncc.

autoreinit

Allow this console to be automatically reinitialized if it unexpectedly goes down. If the console doesn't come back up, it is retried every minute. A console of type ``exec'' that exits with a zero exit status is automatically reinitialized regardless of this setting. The conserver option -F will unset this flag for all consoles. Default is autoreinit.

unloved

Enable the sending of this console's output (prefixed with its name) to the daemon's stdout (or the logfile if in daemon mode) when no clients are connected to the console. The conserver option -u will set this flag for all consoles. Default is !unloved.

login

Allow users to log into this console. If logins are not allowed, conserver will send a generic message to the client saying so and terminate the connection. You can override the generic message by setting the motd message. Default is login.

parity even|mark|none|odd|space

Set the parity option for the console. Only consoles of type ``device'' will use this value.

password password|""

Use password during IPMI authentication. If the null string (``""'') is used (the default), no password will be used.

port number|name

Set the port used to access the console. The port may be specified as a number or a name. A name will cause a getservbyname(3) call to look up the port number. The port, portbase, and portinc values are all used to calculate the final port number to connect to. The formula used is finalport = portbase + portinc * port. By using proper values in the formula, you can reference ports on a terminal server by their physical numbering of 0..n or 1..n (depending on if you like zero-based or one-based numbering). Warning: you can generate a -1 value with this formula, which will become a very high numbered positive value (since things are stored unsigned). You must also set the host option as well. Normally, only consoles of type ``host'' will use this value, however if the devicesubst, execsubst, or initsubst keywords are used in any console type, this value is used.

portbase number

Set the base value for the port calculation formula. number must be 0 or greater. The default is zero. See port for the details of the formula.

portinc number

Set the increment value for the port calculation formula. number must be 0 or greater. The default is one. See port for the details of the formula.

protocol telnet|raw

Set the protocol used to send and receive data from the console. If raw is used, all data is sent ``as is'', unprotected by any protocol specification. If telnet is used (which is the default), data is encapsulated in the telnet protocol. The striphigh console option still applies when data is read by the server, and if enabled, can impact the encapsulation process.

replstring string

A generic replacement string that can be used by the devicesubst, execsubst, and initsubst keywords.

ro [!]username[,...]|""

Define a list of users making up the read-only access list for the console. If username matches a previously defined group name, all members of the previous group are applied to the read-only access list (with access reversed if prefixed with a `!'). If username doesn't match a previously defined group and username begins with `@', the name (minus the `@') is checked against the host's group database. All users found in the group will be granted (or denied, if prefixed with `!') read-only access. If username doesn't match a previous group and doesn't begin with `@', the users will be granted (or denied, if prefixed with `!') read-only access. If the null string (``""'') is used, any users previously defined for the console's read-only list are removed.

rw [!]username[,...]|""

Define a list of users making up the read-write access list for the console. If username matches a previously defined group name, all members of the previous group are applied to the read-write access list (with access reversed if prefixed with a `!'). If username doesn't match a previously defined group and username begins with `@', the name (minus the `@') is checked against the host's group database. All users found in the group will be granted (or denied, if prefixed with `!') read-write access. If username doesn't match a previous group and doesn't begin with `@', the users will be granted (or denied, if prefixed with `!') read-write access. If the null string (``""'') is used, any users previously defined for the console's read-write list are removed.

tasklist c[,...]|""

Associate a list of tasks referenced by c with the console. If ``*'' is used (the default), all defined tasks will be available. If the null string (``""'') is used, no tasks will be available.

timestamp [number[m|h|d|l]][a][b]|""

Specifies the time between timestamps applied to the console log file and whether to log read/write connection actions. The timestamps look like ``[-- MARK -- Mon Jan 25 14:46:56 1999]''. The `m', `h', and `d' tags specify ``minutes'' (the default), ``hours'', and ``days''. The `l' tag specifies ``lines'' and will cause timestamps of the form ``[Mon Jan 25 14:46:56 PST 1999]'' to be placed every number lines (a newline character signifies a new line). So, ``5h'' specifies every five hours and ``2l'' specifies every two lines. An `a' can be specified to add logs of ``attached'', ``detached'', and ``bumped'' actions, including the user's name and the host from which the client connection was made. A `b' can be specified to add logging of break sequences sent to the console.

type device|ipmi|exec|host|noop|uds

Set the type of console. A type of ``device'' should be used for local serial ports (also set the device value). A type of ``ipmi'' should be used for IPMI serial over LAN consoles (also set the host value and possibly the username, password, and ipmi* values). A type of ``exec'' should be used for command invocations (perhaps also set the exec value). A type of ``host'' should be used for terminal servers and other TCP socket-based interaction (also set the host and port values). A type of ``noop'' should be used as a placeholder - it does nothing, ignores any logfile value and forces the !nologin option (so you might want to set the motd value). A type of ``uds'' should be used for Unix domain sockets (also set the uds option).

uds filename

Assign the Unix domain socket filename as the path to the console. Only consoles of type ``uds'' will use this value.

udssubst c=t[n]f[,...]|""

Perform character substitutions on the uds value. See the devicesubst option for an explanation of the format string. If the null string (``""'') is used, no replacements will be done.

username username|""

Use username during IPMI authentication. If the null string (``""'') is used (the default), the ``null'' user will be used.

group name

Define a user group identified as name.

users [!]username[,...]|""

Define a list of users making up the group name. If username matches a previously defined group name, all members of the previous group are applied to the current group (with access reversed if prefixed with a `!'). If username doesn't match a previously defined group and username begins with `@', the name (minus the `@') is checked against the host's group database. All users found in the group will be recorded with (or without, if prefixed with `!') access. If username doesn't match a previous group and doesn't begin with `@', the users will be recorded with (or without, if prefixed with `!') access. If the null string (``""'') is used, any users previously defined for this group are removed.

task c

Define a task where c is a lowercase alphanumeric (0-9a-z). Tasks are invoked via the ``^Ec!c'' client escape sequence.

cmd command|""

Invoke command on the server when instructed by the client. All file descriptors are closed, except for stderr (which is inherited from the server). The command is passed as an argument to ``/bin/sh -ce'' and is a ``fire and forget'' methodology (you need to check logs for any issues). If the null string (``""'') is used, the entire task definition is ignored.

confirm yes|true|on|no|false|off

Set whether or not to ask the client for confirmation before invoking the task. The default is ``no''.

description string

Set a description for the task. When a client lists tasks, string will be printed instead of the command defined above. If the null string (``""'') is used, the command defined above will be printed.

runas [user][:group]|""

By default, the command invoked by cmd is run with the same privileges as the server. If the server is running with root privileges, this option resets the user and/or group of the invoked process to user and group respectively. user may be a username or numeric uid and group may be a group name or numeric gid. Either one is optional. If the server is not running with root privileges, these values are not used. If the null string (``""'') is specified, the default of running with the same privileges as the server is restored.

subst c=t[n]f[,...]|""

Perform character substitutions on the cmd value. See the devicesubst option for an explanation of the format string. If the null string (``""'') is used, no replacements will be done.

## AUTHORS
Bryan Stansell, conserver.com

## SEE ALSO
console(1), conserver.passwd(5), conserver(8)


conserver.passwd

title: conserver.passwd(5)

summary: user access information for

text:
# conserver.passwd(5)

## NAME
conserver.passwd - user access information for conserver(8)

## SYNOPSIS
username:password

## DESCRIPTION
The conserver.passwd file is the user authentication and authorization file for conserver(8). Upon each incoming client connection, conserver opens and reads the conserver.passwd file, so edits to the file take effect immediately. It reads only until the first username match.

Blank lines and comment lines (those beginning with a ``#'' and optional leading whitespace) are ignored. Non-ignored lines beginning with whitespace are considered continuations of the previous line. This allows you to span one logical line over many physical lines and insert comments wherever appropriate.

Each logical line consists of two colon-separated fields. Leading and trailing white space in each field is ignored.

username

the login name of the authorized user, or the string ``*any*'' to match any user. This is compared against the name sent by the console client, based either on the user's identity or on the -l option. Since conserver only uses the first username match, a ``*any*'' entry will apply to any user without an entry earlier in the file.

password

the encrypted password, or the string ``*passwd*'' to indicate that conserver should look up the user's password in the system passwd (or shadow) database. If PAM support has been enabled (--with-pam), PAM lookups will be done instead of passwd (or shadow) lookups (you may need to edit /etc/pam.conf or create /etc/pam.d/conserver). If this field is empty, password checking is bypassed for this user.

## EXAMPLE
mary:r71mXjfALB5Ak

Mary uses the password specified above; it does not matter whether she has a login on the conserver host.

fred:*passwd*

Fred may connect only with his regular login password on the conserver host.

bozo:*

Bozo is only allowed to access a console if his password isn't used (since it's invalid) which means he needs to come from a trusted host.

*any*:*passwd*

Anyone not listed above uses their regular login and password.

## SEE ALSO
console(1), conserver.cf(5), conserver(8)

## BUGS
There is currently no way provided by the conserver package to generate the encrypted password strings besides copying them from the system passwd database or running crypt(3) via C or perl or some other language that supports it.